fix(ci): green the Build, Test & Lint job — doctype integration + vuln scan - #7
Merged
Merged
Conversation
…iation The `test-integration` suite (TestMxCheck_DoctypeScripts) started failing once the multi-version pluggable-widget reconciliation landed. Two showcase scripts regressed — both because reconciliation stopped masking genuine widget incompleteness, not because of a defect in the generated BSON: 32-pluggable-widget-object-lists-v010.mdl (modelsdk): the OL09 HeatMap only set its SCALECOLOR entries and never bound a data series, so mx check reported CE0642 "Property 'Series'/'Value attribute' is required". Reconciling the HeatMap definition to the installed .mpk correctly marks those required (the old embedded template understated it). Complete the example with the widget-level DataSource / HorizontalAxisAttribute / VerticalAxisAttribute / ValueAttribute binding, mirroring the passing HeatMap in 34-chart-widget-examples.mdl — the object-list showcase now demonstrates a complete, deployable heat map. 17-custom-widget-examples.mdl (both engines): the IMAGE showcases author bare/default static-image-mode Image widgets to demonstrate the IMAGE keyword's basic/dimensions/onclick syntax. MDL exposes no property to bind a static image resource (only imageUrl mode), so a default Image is legitimately "No image selected." — exactly what a freshly-dropped Image shows in Studio Pro. It previously passed only because a stale Atlas_Core.Content.Mendix template default masked it; that default caused CE0463 and was removed in the Image CE0463 fix. Whitelist the message for this script via scriptKnownCEErrors (now documented to also accept a message substring where an error carries no CE code), matching the existing syntax-showcase-limitation pattern. Verified on Mendix 11.12.1: all three previously-failing subtests pass; #32 retains only the globally-tolerated Maps CE0463. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
govulncheck (the vuln-scan step in Build, Test & Lint) flags GO-2026-5970, "Infinite loop on invalid input" in golang.org/x/text, reachable via catalog.Catalog.Query → sql.Rows.Columns → norm.Form and mpr.OpenWithOptions → sql.Open → norm.Form. The advisory is fixed in golang.org/x/text v0.39.0; bump the (indirect) requirement to it. go mod tidy also nudges the transitive golang.org/x/sync v0.20.0 → v0.21.0. Build is clean. This gate lives in the same CI job as the doctype integration tests, so it only surfaced once those passed; the fix greens the job and, once merged, main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
ako
changed the title
This was referenced Jul 25, 2026
ako
pushed a commit
that referenced
this pull request
Jul 27, 2026
Three checker hints steered authors the wrong way: - MDL001 (nested loop) recommended `retrieve $Match from $List where … limit 1`, which is a parse error — a plain retrieve cannot filter a list variable. Recommend `$Match = FIND($List, <cond>)` (in-memory, O(N)). Same broken advice fixed in CLAUDE.md idiom #2. - MDL044 flagged `count()` used in an expression with "Did you mean 'round()'?" — count is an aggregate activity, not a typo. For the known aggregates (count/sum/average/minimum/maximum) emit "assign it to a variable first: $n = count($List);" instead of a did-you-mean. - MDL044's generic hint cited `mxcli syntax expressions`, which does not exist; point it at `mxcli syntax microflow`. Also lock in finding #5's second trigger: a microflow-call output variable reused across a fallback chain (try A, else try B) is CE0111. It was already caught by the shared create-output-variable check (`check --references`); add TestValidateDuplicateMicroflowCallOutputVar (same-scope + nested-in-if) as a regression guard and document the correct pattern (one variable per call + a plain set) in write-microflows.md. Reported from the RSS-reader build (findings #7, #8, #14c, #5). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes that green the
Build, Test & Lintjob, which had been failing onmainsince 2026-07-20. The job runs the integration doctype tests, then lint, thengovulncheck; the first failure masked the second, so both are addressed here.1. Integration doctype suite (
TestMxCheck_DoctypeScripts)Went red inside the multi-version pluggable-widget reconciliation work. Two syntax-showcase scripts regressed — both because reconciliation stopped masking genuine widget incompleteness, not because of a defect in the generated BSON.
32-pluggable-widget-object-lists-v010.mdl(modelsdk)CE0642"Property 'Series' / 'Value attribute' is required" on HeatMapheatMap1scalecolorentries and never bound a data series. Reconciling the HeatMap definition to the installed.mpkcorrectly marks Series/Value required (the old embedded template understated it).17-custom-widget-examples.mdl(both engines)[Error] "No image selected."×3imageUrlmode), so a default Image is legitimately "No image selected" — exactly what a freshly-dropped Image shows in Studio Pro. It previously passed only because a staleAtlas_Core.Content.Mendixtemplate default masked it; that default caused CE0463 and was removed in the Image CE0463 fix.Changes:
32-…object-lists-v010.mdl— complete OL09's HeatMap with the widget-levelDataSource/HorizontalAxisAttribute/VerticalAxisAttribute/ValueAttributebinding, mirroring the passing HeatMap in34-chart-widget-examples.mdl. The showcase now demonstrates a complete, deployable heat map.roundtrip_doctype_test.go— whitelist"No image selected."for17-custom-widget-examples.mdlviascriptKnownCEErrors, matching the existing syntax-showcase-limitation pattern (03,06b). The map doc-comment now notes that, where an error carries no CE code, a distinctive message substring may be listed (already supported byallErrorsKnown's substring match).Verified on Mendix 11.12.1 (matching CI) with
-tags integration:17/modelsdk,17/legacy,32/modelsdkall pass;32/modelsdkretains only the globally-tolerated MapsCE0463.32/legacyremains SKIP (pre-existing — legacy widget builder lacks the linechart template).2. Vulnerability scan (
govulncheck ./...)Once the integration tests passed, the job reached
govulncheck, which flags GO-2026-5970 ("Infinite loop on invalid input") ingolang.org/x/text@v0.37.0, reachable viacatalog.Catalog.Queryandmpr.OpenWithOptions→norm.Form. Advisory is fixed in v0.39.0.Change: bump the (indirect)
golang.org/x/textrequirement tov0.39.0;go mod tidyalso nudges transitivegolang.org/x/syncv0.20.0 → v0.21.0. Build is clean.No production code changes — only a doctype example script, the test allowlist, and a dependency bump.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4